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Age Appropriate Design Code call for evidence 
Engagement Department 
Information Commissioner’s Office 
Wycliffe House 
Water Lane 
Wilmslow 
Cheshire SK9 5AF 
United Kingdom 
Sept. 21, 2018 


Dear Commissioner Denham: 


| write to you as the proponent of a California ballot initiative that became the 
recently passed California Consumer Privacy Act (CCPA) (June 2018). 


The narrative of the CCPA’s passage, and the grassroots campaign which led up to 
it, was recently chronicled by the New York Times Magazine (hyperlink in e-version, 
otherwise search for August 14, 2018 magazine cover article). 


Upon its passage via the state legislature in June 2018, the CCPA (also known as 
Assembly Bill 375) gave California’s 40 million citizens the most comprehensive 
consumer privacy protections ever enacted in the United States, including the rights 
to: 


1. Find out what information large corporations and data brokers have collected 
about Californians (Transparency): 

2. Tell corporations to stop selling Californians’ personal information (Control): 
and 

3. Require corporations to keep Californians’ personal information more secure 
(Accountability). 


The three principles of Transparency, Control and Accountability were our guiding 
template, and we are thrilled to have achieved substantial progress in these areas. 


In addition, one of our major victories was to achieve greater control over children’s 
information, since the law requires opt-in permission prior to selling personal 
information of children under 16. Children’s consumer privacy rights continue to be 
a priority of our organization. 


With that in mind, we applaud the UK Government for introducing the Age 
Appropriate Design Code. It is critical that the worldwide movement towards greater 
data privacy for all people includes strong protections for children, and we are 
heartened by your Government’s leadership in this endeavor. 


It is also important to acknowledge that children are on a journey over the course of 
their upbringing, when they are forming lasting data habits, and also, unfortunately, 
being groomed for a lifetime of data harvesting by corporations. 


Californians for Consumer Privacy supports the Code using the standard of a child’s 
"best interest” in each data decision/or interaction. 


Therefore, we recommend that the Commissioner include: 


e The right to transparency. Parents and children should know what data is 
collected by a business on minors. (The CCPA allows consumers to access 
this information twice annually, free of charge). 

e The right to control. Parents and children should be able to control the data 
collected by companies on minors. The CCPA requires opt-in consent prior 
to the sale of California children’s information (under 16). In the US, our First 
Amendment right to freedom of speech extends to corporations, therefore 
making the “right to be forgotten” difficult to replicate. However, the CCPA’s 
right to deletion does provide substantial control over what personal 
information exists in the hands of private companies. Given that children are 
often unaware of the consequences of their actions, we support the 
European “right to be forgotten,” covering much of the data collected about 
children. 

e The right to accountability. Parents and children should be able to enforce 
the rights enumerated by data privacy laws. In California, consumers can 
exercise their right to private action if a business fails to protect the 
consumers personal information in the event of a data breach. 


Many have accused us, and the California Consumer Privacy Act, of being anti- 
business, and have said that this law would hurt the ‘innovation engine’ that powers 
California, the home to Silicon Valley. 


Nothing could be farther from the truth. Our common-sense legislation is written in 
a manner to ensure that we do not harm commerce, whether online or traditional, 
while ensuring crucial consumer privacy rights for California consumers. 


As exemplified by the Cambridge Analytica debacle and countless data breaches, 
two truths remain: regulation is desperately needed around privacy, data collection 
and data sale in the technology and data industries; and these industries are 
incapable of regulating themselves. That said, we feel optimistic that given the 


actions being taken by governments and activists across the globe, meaningful 
progress is being made to take back control of consumers’ personal information. 


We urge the Commissioner to act on behalf of UK children, and set the highest bar 
of data privacy — and in doing so, act for children everywhere. The Age Appropriate 
Design Code should be a beacon of what good data practice looks like for people 
the world over. 


Sincerely, 


WE Californians for Consumer Privacy 


